CVE-2023-5013: 
Pluck CMS vulnerability analysis and mitigation

A cross-site scripting (XSS) vulnerability has been identified in Pluck CMS version 4.7.18, specifically affecting the installation handler component (install.php). The vulnerability was assigned CVE-2023-5013 and was disclosed in September 2023. This security flaw affects the content manipulation functionality during the installation process (NVD).

The vulnerability exists in the installation handler (install.php) of Pluck CMS 4.7.18. The flaw allows for the manipulation of the argument contents with malicious input such as alert('xss'). The vulnerability has been assessed with a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) (NVD).

When successfully exploited, this vulnerability allows an attacker to perform cross-site scripting attacks. The impact is considered medium severity, with potential for limited confidentiality and integrity breaches, though no availability impact has been identified (NVD).

The vulnerability can be exploited during the installation process of Pluck CMS. A proof of concept exists where an attacker can inject malicious JavaScript code (such as alert('xss')) during the installation steps, specifically in step 3 of the installation process. The attack can be triggered when viewing the website after installation (Github POC).